Protecting Your Network From The Inside-Out

WHITE PAPERProtecting Your NetworkFrom the Inside-OutInternal Segmentation Firewall (ISFW)

Table of ContentsSummary.2Advanced Threats Take Advantage of the “Flat Internal” Network.3The Answer is a New Class of Firewall – Internal Segmentation Firewall.4ISFW Technology Requirements.6Conclusion.8SummaryFor the last decade organizations have been trying to protecttheir networks by building defenses across the borders of theirnetwork. This includes the Internet edge, perimeter, endpoint,and data center (including the DMZ). This ‘outside-in’ approachhas been based on the concept that companies can controlclearly defined points of entry and secure their valuable assets.The strategy was to build a border defense as strong as possibleand assume nothing got past the firewall.As organizations grow and embrace the latest IT technology such as Mobility andCloud the traditional network boundaries are becoming increasingly complex to controland secure. There are now many different ways into an enterprise network.Not long ago, firewall vendors marked the ports on their appliances ‘External’(Untrusted) and ‘Internal’ (Trusted). However, advanced threats use this to theiradvantage because, once inside, the network is very flat and open. The inside of thenetwork usually consists of non-security aware devices such as switches, routers andeven bridges. So once you gain access to the network as a hacker, contractor or evenrogue employee, then you get free access to the entire enterprise network including allthe valuable assets.Key RequirementsnnnnCOMPLETE PROTECTION –Continuous inside-out protectionagainst advanced threats with asingle security infrastructurePOLICY-DRIVENTo better control andcompartmentalize users and limitthreat vectors access to sensitiveresourcesEASY DEPLOYMENT –Default Transparent Mode meansno need to re-architect thenetwork and centrally deployedand ManagedHIGH PERFORMANCE –Multi-gigabit performance supportswire speed East-West trafficThe solution is a new class of firewall – Internal Segmentation Firewall (ISFW), thatsits at strategic points of the internal network. It may sit in front of specific serversthat contain valuable intellectual property or a set of user devices or web applicationssitting in the cloud.2www.fortinet.com

WHITE PAPER: PROTECTING YOUR NETWORK FROM THE INSIDE–OUT – INTERNAL SEGMENTATION FIREWALL (ISFW)Once in place, the ISFW must provide instant “visibility” totraffic traversing into and out of that specific network asset.This visibility is needed instantly, without months of networkplanning and deployment.Most importantly the ISFW must also provide “protection”because detection is only a part of the solution. Siftingthrough logs and alerts can take weeks or months; theISFW needs to deliver proactive segmentation and real-timeprotection based on the latest security updates.Finally, the ISFW must be flexible enough to be placedanywhere within the internal network and integrate with otherparts of the enterprise security solution under a single paneof management glass. Other security solutions can alsoprovide additional visibility and protection. This includes theemail gateway, web gateway, border firewalls, cloud firewallsand endpoints. Further, Internal Segmentation Firewalls needto scale from low to high throughputs allowing deploymentacross the global network.Advanced Threats Take Advantageof the “Flat Internal” NetworkCybercriminals are creating customized attacks to evadetraditional defenses, and once inside, to avoid detection andenable egress of valuable data. Once inside the network thereare few systems in place to detect or better still protectagainst APTs.It can be seen from the threat life cycle in Figure 1 that oncethe perimeter border is penetrated, the majority of the activitytakes place inside the boundary of the network. Activitiesinclude disabling any agent-based security, updates from thebotnet command and control system, additional infection/recruitment and extraction of the targeted assets.FIGURE 1 – ADVANCED THREAT LIFE CYCLEExternalScan for vulnerabilitiesDesign phishing emailsCustomize malware, etc.1Social EngineeringZero Days ExploitsMalicious URLsMalicious Apps, moreInfectionThreat VectorThreat Production ReconAPP4ExtractionPackage &Encrypt StageDisposalInternal2URLCommunication3Hide, Spread,Disarm, Access,Contact Botnet C&C,Update3

WHITE PAPER: PROTECTING YOUR NETWORK FROM THE INSIDE–OUT – INTERNAL SEGMENTATION FIREWALL (ISFW)The Answer is a New Class of Firewall –Internal Segmentation Firewall (ISFW)Most firewall development over the past decade has beenfocused on the border, the Internet edge, perimeter (hostfirewall), endpoint, data center (DMZ) or the cloud. Thisstarted with the stateful firewall but has evolved to includeUnified Threat Management (UTM) for distributed networks,which brought together the firewall, intrusion detection andantivirus. Later came the Next Generation Firewall (NGFW),which included intrusion prevention, and application controlfor the Internet edge. More recently because of the hugeincrease in speeds, Data Center Firewalls (DCFW) havearrived to provide more than 100Gbps of throughput. All ofthese firewalls have in common an approach designed toprotect from the “outside-in.”Foundation of ISFWEnterprises should deploy ISFW with next generationfunctionalities in strategic points within the internal network,adding an additional security layer to provide the followingsecurity benefits:n Control access to critical resources/assets as close aspossible to the user via policy-driven segmentation.n Establish security barriers to stop and limit the uncontrolledspread of threats and hackers activity within the internalnetwork via the implementation of advanced securitymechanisms.n Limit the potential damage of threats inside the perimeter.n Increase threat visibility and enhance breach discovery andmitigation.n Strengthen the enterprise’s overall security posture.For rapid internal deployment and protection, a new class offirewall is required – Internal Segmentation Firewall (ISFW).The Internal Segmentation Firewall has some differentcharacteristics when compared to a border firewall. Thedifferences are laid out in figure 2.Deployment ModeISFWNGFWDCFWUTMCCFWPurposeVisibility & protectionfor internal segmentsVisibility & protection against externalthreats and internetactivitiesHigh performance,lowlatency networkaprotectionVisibility & protection against externalthreats and useractivitiesNetwork security forService ProvidersLocationAccess LayerInternet GatewayCore Layer/DCGatewayInternet GatewayVariousNAT/Route ModeNAT/Route ModeNAT/Route ModeNAT/Route ModeNetwork Operation Mode Transparent ModeHardware RequirementsHigher port density to GbE and 10GbE ports High speed (GbE/10protect multiple assetsGbE/40 GbE/100) &high port density,hardware accelerationSecurity ComponentsFirewall, IPS, ATP,Application Control(User-based) Firewall,VPN, IPS, ApplicationControlFirewall, DDoS protec- Comprehensive andtionextensible, client anddevice integrationFirewall, CGN, LTE& mobile securityOther CharacteristicsRapid Deployment– near zero configurationIntegration withAdvanced ThreatProtection (Sandbox)High AvailabilityHigh AvailabilityHigh GbE port density, High speed (GbE/10GbE/40 GbE) &integrated wirelessconnectivity and POE high port density,hardware accelerationDifferent WANConnectivity Optionssuch as 3G4GFIGURE 2 – FIREWALL TYPE DIFFERENCES4www.fortinet.com

WHITE PAPER: PROTECTING YOUR NETWORK FROM THE INSIDE–OUT – INTERNAL SEGMENTATION FIREWALL (ISFW)The ISFW needs to provide policy-drivensegmentationPolicy – driven segmentation enables better control andcompartmentalization of user’s access to applicationsand resources via the association of the user’s identitywith specific security policies enforcement. Policy-basedsegmentation can limit potential attack vectors and threatsvehicled by the user.Policy-based segmentation can be defined as the automaticassociation of user’s identity and the enforced security policy.A user’s identity may be defined as a set of attributes, suchas physical location, the type of device used to access thenetwork, the application used, etc. As the user’s identitymay change dynamically, the enforced security policy mustdynamically and automatically follow the user’s identity.In order to achieve the required user identification and theoverall parameters needed to create and enforce granularsecurity policies, ISFW must be able to:1. Allow user, device and application identification2. Provide integration with directory services solutions toidentify user’s identity3. Dynamically map a user’s identity to a specific securitypolicy and enforcementThe ISFW needs to provide complete protectionThe first element of security is visibility. And visibility is onlyas good as network packet knowledge. What does a packetstream look like for a specific application, where did it comefrom, where is it going, even what actions are being taken(download, upload ).The second and equally important element is protection. Isthe application, content or actions malicious? Should thistype of traffic be communicating from this set of assetsto another set of assets? While this is very difficult acrossdifferent content and application types, it is an essential partof the ISFW. The ability to detect a malicious file, applicationor exploit gives an enterprise time to react and contain thethreat. All of these protection elements must be on a singledevice to be effective.The ISFW needs to provide easy deploymentThe ISFW must be easy to deploy and manage. Keepingit simple for IT means being able to deploy with minimumconfiguration requirements and without having to re-architectthe existing network.The ISFW must also be able to protect different types ofinternal assets placed at different parts of the network. Itcould be a set of servers containing valuable customerinformation or a set of endpoint devices that may not be ableto be updated with the latest security protection.Additionally the ISFW must be able to integrate with otherparts of the enterprise security solution. Other securitysolutions can also provide additional visibility and protection.This includes the email gateway, web gateway, borderfirewalls, cloud firewalls and endpoints. This all needs to bemanaged with a ‘single pane of glass’ approach. This allowssecurity policies to be consistent at the border, inside thenetwork and even outside the network in clouds.Additionally, traditional firewalls are usually deployed in routingmode. Interfaces (ports) are well defined with IP addresses.This often takes months of planning and deployment. This isvaluable time in today’s instant cyber attack world. An ISFWcan be deployed in the network rapidly and with minimumdisruption. It must be as simple as powering on a deviceand connecting. It must be transparent to the network andapplication.The ISFW needs to provide wire-speed performanceBecause internal segmentation firewalls are deployed in-linefor network zoning, they must be very high performance inorder to meet the demands of internal or “East/West” traffic,and to ensure they do not become a bottleneck at thesecritical points. Unlike firewalls at the border which deal withWide Area Network (WAN) access or Internet speeds ofless than 1 gigabit per second, internal networks run muchfaster – multi-gigabit speeds. There, ISFWs need to operateat multi-gigabit speeds and be able to provide deep packet/connect inspection without slowing down the network.Both visibility and protection are heavily reliant on a realtime central security threat intelligence service. A questionthat always needs to posed – how good is the visibility andprotection. Is it keeping up with the latest threats? That’s whyall security services should be measured on a constant basiswith 3rd party test and certification services.5